UruguayCódigo Penal arts. 297 bis, 297 ter, 297 quater, 358 quater, and 358 quinquies, computer-offence provisions inserted by Ley N° 20.327
Ley N° 20.327 de 23 de agosto de 2024 (Diario Oficial de 25 de septiembre de 2024), arts. 6 y 8, Código Penal arts. 297 bis, 297 ter, 297 quater, 358 quinquies
In force.
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction, Security
- Audit expectation
- none
What it requires
- Do not access, intercept, disclose, sell, or transfer another's information held on a digital medium by computer or telematic means without authorization and without just cause.NIST AI RMFMAP 4.1
- Reading a public, unauthenticated page without defeating any access control has not itself been held to violate these provisions.
- Do not access, appropriate, use, or modify a third party's confidential data held on a digital medium without the holder's authorization, and do not disclose, reveal, or transfer such data to a third party.NIST AI RMFMAP 4.1
- Do not destroy, alter, or render unusable data or computer systems belonging to another without authorization.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Unauthorized access, illicit interception, and computer damage (Código Penal arts. 297 bis, 297 ter, and 358 quater) each carry six to twenty-four months' imprisonment. Appropriating or modifying a third party's confidential data (art. 297 quater, first paragraph) carries the same six-to-twenty-four-month range, rising to one to four years' imprisonment where the data is disclosed, revealed, or transferred to a third party (art. 297 quater, second paragraph), a range aggravated further where the data is personal data protected under Ley N° 18.331.
What it makes you log
Logging duty
Articles 297 bis, 297 ter and 297 quater (inserted by article 6) and 358 quinquies (article 8) create offences of unlawful access to computer data, unlawful interception, breach of confidential data held in digital media or public or private files, and abuse of devices, each punished with six to twenty-four months of prison, with higher penalties in 297 quater where the data is disclosed. Article 358 quater (damage to computer data or systems, article 5) has the same shape. None imposes a duty to create, keep, produce or review a log or record on the person it reaches. Article 10 of the Act only authorizes financial intermediaries and electronic-money issuers to create shared registers of data to identify and prevent unconsented transactions, and article 11 has them report a funds freeze to the central bank within one business day; both sit outside the articles the row cites and neither is borrowed. The articles state no territorial clause, so no hook is recorded.
- Kind
- None
- As of
What this law does
Article 297 bis (acceso ilícito a datos informáticos) punishes with six to twenty-four months' imprisonment anyone who, by computer or telematic means, without authorization and without just cause, accesses, interferes with, discloses, sells, or transfers another's information held on a digital medium; because the offence's trigger is acting without authorization, reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision.
Article 297 ter punishes unauthorized interception of non-public data transmissions with the same six-to-twenty-four-month range.
Article 297 quater (vulneración de datos) punishes, with the same six-to-twenty-four-month range, accessing, appropriating, using, or modifying a third party's confidential data held on a digital or other medium without the holder's authorization, and separately punishes disclosing, revealing, or transferring such data to a third party with one to four years' imprisonment, aggravated where the data are personal data protected under Ley N° 18.331.
Article 358 quater (daño informático) punishes destroying, altering, or rendering unusable data or computer systems without authorization and with intent to cause harm with six to twenty-four months' imprisonment. Article 358 quinquies (abuso de los dispositivos) punishes producing, acquiring, importing, marketing, or supplying to a third party a program, system, or access credential unequivocally intended for committing an offence, with the same six-to-twenty-four-month range.
Ley N° 20.327 states no day of its own entry into force; absent a stated day, article 1 of the Civil Code brings an undated law into force ten days after its promulgation is verified in the capital, a computed day rather than one a source states.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .